The vulnerability CVE-2026-14638 affects itsourcecode Hospital Management System version 1.0. It is caused by improper sanitization of the 'editid' parameter in the /patient.php file, allowing an attacker to perform SQL injection. This can be triggered remotely without authentication or user interaction. The CVSS 4.0 base score is 5.3 (medium), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. Although an exploit has been published, no active exploitation in the wild has been reported. No official patch or fix has been disclosed by the vendor as of the publication date.

Successful exploitation of this SQL injection vulnerability could allow an attacker to manipulate backend database queries, potentially leading to unauthorized data access or modification. The impact is rated medium due to limited confidentiality, integrity, and availability impact as per the CVSS vector. There is no evidence of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for vendor updates. Until a patch is available, consider applying application-level input validation or web application firewall rules to detect and block malicious 'editid' parameter inputs.